Extracted

• • Target

    invoice.exe

  • Size

    384KB

  • MD5

    e6fcc19f1ef03db2c4d40dcb949ce40f

  • SHA1

    0823317ace170ee272b02368c9a3daa5a292765b

  • SHA256

    3f5c9bf874c9e7dbbd79fcafa447c3ae0f35659827f91555ba09a2fa13a862dd

  • SHA512

    4bdaab26e5deb5da4fa93dc583da96292f05e40dd0da2b26eb1e33d7b5ce68f3db751586839826d43d9c0202ca2dfb8cccb51eda70c72bde7cf9e80779edc460

  • SSDEEP

    6144:yQ78PdlxClB67NxX6JyBVIbMNISinsysqZbMyLYDtVJyg:yFSejXbVhISgdsqZbHLY3

  Score

  10^/10

  formbookrs26discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2